Default accounts and passwords are often published and well known, which makes them particularly susceptible to what?

• A. They can be used by attackers to gain unauthorized initial access
• B. They can be used for convenience in testing in a secure environment
• C. They are published and well known, and therefore easily guessed
• D. They are automatically rotated by default

Answer: (C)

The risk hinges on how visible and predictable those credentials are. Default accounts and passwords are often published in vendor docs, public databases, and attack scripts, so they are widely known. That means attackers don’t need to perform complex guessing; they can simply use the documented defaults or lists and gain access, which is why they’re easily guessed. In practice, automated attackers routinely scan for these exact defaults and try them to seize initial access. The other ideas don’t capture why this is such a vulnerability: testing in secure environments isn’t the production risk here, automatic rotation would reduce risk rather than cause it, and the real danger is the ease with which known defaults can be exploited.